linux-kernel - [PATCH] media: ipu-bridge: Add missing acpi_dev_put() in ipu_bridge_get_ivsc_acpi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 29 Sep 2023 11:31:33 +0200
From:   Geert Uytterhoeven <geert+renesas@...der.be>
To:     Wentong Wu <wentong.wu@...el.com>,
        Mauro Carvalho Chehab <mchehab@...nel.org>,
        Sakari Ailus <sakari.ailus@...ux.intel.com>,
        Andy Shevchenko <andriy.shevchenko@...ux.intel.com>
Cc:     linux-media@...r.kernel.org, linux-kernel@...r.kernel.org,
        Geert Uytterhoeven <geert+renesas@...der.be>
Subject: [PATCH] media: ipu-bridge: Add missing acpi_dev_put() in ipu_bridge_get_ivsc_acpi_dev()

In ipu_bridge_get_ivsc_acpi_dev(), the "ivsc_adev" acpi_device pointer
from the outer loop is handed over to the caller, which takes proper
care of its reference count.
However, the "consumer" acpi_device pointer from the inner loop is lost,
without decrementing its reference count.

Fix this by adding the missing call to acpi_dev_put().

Fixes: c66821f381aed2c7 ("media: pci: intel: Add IVSC support for IPU bridge driver")
Signed-off-by: Geert Uytterhoeven <geert+renesas@...der.be>
---
Compile-tested only.

This driver really likes nesting loops: the above inner loop is actually
5 levels deep, of which 3 levels use for_each_acpi_*().  And all of that
is done twice:

ipu_bridge_init
    ipu_bridge_ivsc_is_ready
        for (i = 0; i < ARRAY_SIZE(ipu_supported_sensors); i++)
            for_each_acpi_dev_match(sensor_adev, cfg->hid, NULL, -1)
                for (i = 0; i < ARRAY_SIZE(ivsc_acpi_ids); i++)
                    for_each_acpi_dev_match(ivsc_adev, acpi_id->id, NULL, -1)
                        for_each_acpi_consumer_dev(ivsc_adev, consumer)

    ipu_bridge_connect_sensors
        for (i = 0; i < ARRAY_SIZE(ipu_supported_sensors); i++)
                for_each_acpi_dev_match(adev, cfg->hid, NULL, -1)
                    for (i = 0; i < ARRAY_SIZE(ivsc_acpi_ids); i++)
                        for_each_acpi_dev_match(ivsc_adev, acpi_id->id, NULL, -1)
                            for_each_acpi_consumer_dev(ivsc_adev, consumer)
---
 drivers/media/pci/intel/ipu-bridge.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/media/pci/intel/ipu-bridge.c b/drivers/media/pci/intel/ipu-bridge.c
index 1bde8b6e0b1121a8..e38198e259c03ce9 100644
--- a/drivers/media/pci/intel/ipu-bridge.c
+++ b/drivers/media/pci/intel/ipu-bridge.c
@@ -107,8 +107,10 @@ static struct acpi_device *ipu_bridge_get_ivsc_acpi_dev(struct acpi_device *adev
 		for_each_acpi_dev_match(ivsc_adev, acpi_id->id, NULL, -1)
 			/* camera sensor depends on IVSC in DSDT if exist */
 			for_each_acpi_consumer_dev(ivsc_adev, consumer)
-				if (consumer->handle == handle)
+				if (consumer->handle == handle) {
+					acpi_dev_put(consumer);
 					return ivsc_adev;
+				}
 	}
 
 	return NULL;
-- 
2.34.1